gsd-pi 2.5.0 → 2.5.1

package/dist/loader.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import { fileURLToPath } from 'url';
 import { dirname, resolve, join } from 'path';
-import { readFileSync } from 'fs';
-import { agentDir } from './app-paths.js';
+import { existsSync, readFileSync } from 'fs';
+import { agentDir, appRoot } from './app-paths.js';
+import { renderLogo } from './logo.js';
 // pkg/ is a shim directory: contains gsd's piConfig (package.json) and pi's
 // theme assets (dist/modes/interactive/theme/) without a src/ directory.
 // This allows config.js to:
@@ -14,7 +15,24 @@ const pkgDir = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'pkg');
 process.env.PI_PACKAGE_DIR = pkgDir;
 process.env.PI_SKIP_VERSION_CHECK = '1'; // GSD ships its own update check — suppress pi's
 process.title = 'gsd';
-// First-launch branding is handled by the onboarding wizard (src/onboarding.ts)
+// Print branded banner on first launch (before ~/.gsd/ exists)
+if (!existsSync(appRoot)) {
+    const cyan = '\x1b[36m';
+    const green = '\x1b[32m';
+    const dim = '\x1b[2m';
+    const reset = '\x1b[0m';
+    const colorCyan = (s) => `${cyan}${s}${reset}`;
+    let version = '';
+    try {
+        const pkgJson = JSON.parse(readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf-8'));
+        version = pkgJson.version ?? '';
+    }
+    catch { /* ignore */ }
+    process.stderr.write(renderLogo(colorCyan) +
+        '\n' +
+        `  Get Shit Done ${dim}v${version}${reset}\n` +
+        `  ${green}Welcome.${reset} Setting up your environment...\n\n`);
+}
 // GSD_CODING_AGENT_DIR — tells pi's getAgentDir() to return ~/.gsd/agent/ instead of ~/.gsd/agent/
 process.env.GSD_CODING_AGENT_DIR = agentDir;
 // NODE_PATH — make gsd's own node_modules available to extensions loaded via jiti.

package/dist/logo.d.ts

@@ -3,14 +3,14 @@
  *
  * Single source of truth — imported by:
  *   - scripts/postinstall.js (via dist/logo.js)
- *   - src/onboarding.ts (via ./logo.js)
+ *   - src/loader.ts (via ./logo.js)
  */
 /** Raw logo lines — no ANSI codes, no leading newline. */
-export declare const GSD_LOGO: string[];
+export declare const GSD_LOGO: readonly string[];
 /**
  * Render the logo block with a color function applied to each line.
  *
- * @param color — e.g. picocolors.cyan or `(s) => `\x1b[36m${s}\x1b[0m``
+ * @param color — e.g. `(s) => `\x1b[36m${s}\x1b[0m`` or picocolors.cyan
  * @returns Ready-to-write string with leading/trailing newlines.
  */
 export declare function renderLogo(color: (s: string) => string): string;

package/dist/logo.js

@@ -3,7 +3,7 @@
  *
  * Single source of truth — imported by:
  *   - scripts/postinstall.js (via dist/logo.js)
- *   - src/onboarding.ts (via ./logo.js)
+ *   - src/loader.ts (via ./logo.js)
  */
 /** Raw logo lines — no ANSI codes, no leading newline. */
 export const GSD_LOGO = [
@@ -17,7 +17,7 @@ export const GSD_LOGO = [
 /**
  * Render the logo block with a color function applied to each line.
  *
- * @param color — e.g. picocolors.cyan or `(s) => `\x1b[36m${s}\x1b[0m``
+ * @param color — e.g. `(s) => `\x1b[36m${s}\x1b[0m`` or picocolors.cyan
  * @returns Ready-to-write string with leading/trailing newlines.
  */
 export function renderLogo(color) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-pi",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "GSD — Get Shit Done coding agent",
   "license": "MIT",
   "repository": {

package/src/resources/extensions/get-secrets-from-user.ts

@@ -7,6 +7,7 @@
  */
 
 import { readFile, writeFile } from "node:fs/promises";
+import { existsSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 
 import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
@@ -25,6 +26,8 @@ interface ToolResultDetails {
 	environment?: string;
 	applied: string[];
 	skipped: string[];
+	existingSkipped?: string[];
+	detectedDestination?: string;
 }
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -91,6 +94,52 @@ async function writeEnvKey(filePath: string, key: string, value: string): Promis
 	await writeFile(filePath, content, "utf8");
 }
 
+// ─── Exported utilities ───────────────────────────────────────────────────────
+
+/**
+ * Check which keys already exist in the .env file or process.env.
+ * Returns the subset of `keys` that are already set.
+ * Handles ENOENT gracefully (still checks process.env).
+ * Empty-string values count as existing.
+ */
+export async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {
+	let fileContent = "";
+	try {
+		fileContent = await readFile(envFilePath, "utf8");
+	} catch {
+		// ENOENT or other read error — proceed with empty content
+	}
+
+	const existing: string[] = [];
+	for (const key of keys) {
+		const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		const regex = new RegExp(`^${escaped}\\s*=`, "m");
+		if (regex.test(fileContent) || key in process.env) {
+			existing.push(key);
+		}
+	}
+	return existing;
+}
+
+/**
+ * Detect the write destination based on project files in basePath.
+ * Priority: vercel.json → convex/ dir → fallback "dotenv".
+ */
+export function detectDestination(basePath: string): "dotenv" | "vercel" | "convex" {
+	if (existsSync(resolve(basePath, "vercel.json"))) {
+		return "vercel";
+	}
+	const convexPath = resolve(basePath, "convex");
+	try {
+		if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {
+			return "convex";
+		}
+	} catch {
+		// stat error — treat as not found
+	}
+	return "dotenv";
+}
+
 // ─── Paged secure input UI ────────────────────────────────────────────────────
 
 /**
@@ -209,16 +258,17 @@ export default function secureEnv(pi: ExtensionAPI) {
 			"Never echo, log, or repeat secret values in your responses. Only report key names and applied/skipped status.",
 		],
 		parameters: Type.Object({
-			destination: Type.Union([
+			destination: Type.Optional(Type.Union([
 				Type.Literal("dotenv"),
 				Type.Literal("vercel"),
 				Type.Literal("convex"),
-			], { description: "Where to write the collected secrets" }),
+			], { description: "Where to write the collected secrets" })),
 			keys: Type.Array(
 				Type.Object({
 					key: Type.String({ description: "Env var name, e.g. OPENAI_API_KEY" }),
 					hint: Type.Optional(Type.String({ description: "Format hint shown to user, e.g. 'starts with sk-'" })),
 					required: Type.Optional(Type.Boolean()),
+					guidance: Type.Optional(Type.Array(Type.String(), { description: "Step-by-step guidance for finding this key" })),
 				}),
 				{ minItems: 1 },
 			),
@@ -240,6 +290,10 @@ export default function secureEnv(pi: ExtensionAPI) {
 				};
 			}
 
+			// Auto-detect destination when not provided
+			const destinationAutoDetected = params.destination == null;
+			const destination = params.destination ?? detectDestination(ctx.cwd);
+
 			const collected: CollectedSecret[] = [];
 
 			// Collect one key per page
@@ -255,7 +309,7 @@ export default function secureEnv(pi: ExtensionAPI) {
 			const errors: string[] = [];
 
 			// Apply to destination
-			if (params.destination === "dotenv") {
+			if (destination === "dotenv") {
 				const filePath = resolve(ctx.cwd, params.envFilePath ?? ".env");
 				for (const { key, value } of provided) {
 					try {
@@ -267,7 +321,7 @@ export default function secureEnv(pi: ExtensionAPI) {
 				}
 			}
 
-			if (params.destination === "vercel") {
+			if (destination === "vercel") {
 				const env = params.environment ?? "development";
 				for (const { key, value } of provided) {
 					try {
@@ -286,7 +340,7 @@ export default function secureEnv(pi: ExtensionAPI) {
 				}
 			}
 
-			if (params.destination === "convex") {
+			if (destination === "convex") {
 				for (const { key, value } of provided) {
 					try {
 						const result = await pi.exec("sh", [
@@ -305,14 +359,15 @@ export default function secureEnv(pi: ExtensionAPI) {
 			}
 
 			const details: ToolResultDetails = {
-				destination: params.destination,
+				destination,
 				environment: params.environment,
 				applied,
 				skipped,
+				...(destinationAutoDetected ? { detectedDestination: destination } : {}),
 			};
 
 			const lines = [
-				`destination: ${params.destination}${params.environment ? ` (${params.environment})` : ""}`,
+				`destination: ${destination}${destinationAutoDetected ? " (auto-detected)" : ""}${params.environment ? ` (${params.environment})` : ""}`,
 				...applied.map((k) => `✓ ${k}: applied`),
 				...skipped.map((k) => `• ${k}: skipped`),
 				...errors.map((e) => `✗ ${e}`),
@@ -329,7 +384,7 @@ export default function secureEnv(pi: ExtensionAPI) {
 			const count = Array.isArray(args.keys) ? args.keys.length : 0;
 			return new Text(
 				theme.fg("toolTitle", theme.bold("secure_env_collect ")) +
-				theme.fg("muted", `→ ${args.destination}`) +
+				theme.fg("muted", `→ ${args.destination ?? "auto"}`) +
 				theme.fg("dim", `  ${count} key${count !== 1 ? "s" : ""}`),
 				0, 0,
 			);

package/src/resources/extensions/gsd/auto.ts

@@ -56,7 +56,7 @@ import {
 } from "./metrics.js";
 import { join } from "node:path";
 import { readdirSync, readFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
-import { execSync } from "node:child_process";
+import { execSync, execFileSync } from "node:child_process";
 import {
   autoCommitCurrentBranch,
   ensureSliceBranch,
@@ -373,7 +373,8 @@ export async function startAuto(
   try {
     execSync("git rev-parse --git-dir", { cwd: base, stdio: "pipe" });
   } catch {
-    execSync("git init", { cwd: base, stdio: "pipe" });
+    const mainBranch = loadEffectiveGSDPreferences()?.preferences?.git?.main_branch || "main";
+    execFileSync("git", ["init", "-b", mainBranch], { cwd: base, stdio: "pipe" });
   }
 
   // Ensure .gitignore has baseline patterns
@@ -675,7 +676,7 @@ function peekNext(unitType: string, state: GSDState): string {
   const sid = state.activeSlice?.id ?? "";
   switch (unitType) {
     case "research-milestone": return "plan milestone roadmap";
-    case "plan-milestone": return "research first slice";
+    case "plan-milestone": return "plan or execute first slice";
     case "research-slice": return `plan ${sid}`;
     case "plan-slice": return "execute first task";
     case "execute-task": return `continue ${sid}`;
@@ -1022,14 +1023,35 @@ async function dispatchNextUnit(
             midTitle = state.activeMilestone?.title;
           } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
+
+            // Safety net: if mergeSliceToMain failed to clean up (or the error
+            // came from switchToMain), ensure the working tree isn't left in a
+            // conflicted/dirty merge state. Without this, state derivation reads
+            // conflict-marker-filled files, produces a corrupt phase, and
+            // dispatch loops forever (see: merge-bug-fix).
+            try {
+              const { runGit } = await import("./git-service.ts");
+              const status = runGit(basePath, ["status", "--porcelain"], { allowFailure: true });
+              if (status && (status.includes("UU ") || status.includes("AA ") || status.includes("UD "))) {
+                runGit(basePath, ["reset", "--hard", "HEAD"], { allowFailure: true });
+                ctx.ui.notify(
+                  `Cleaned up conflicted merge state after failed squash-merge.`,
+                  "warning",
+                );
+              }
+            } catch { /* best-effort cleanup */ }
+
             ctx.ui.notify(
-              `Slice merge failed: ${message}`,
+              `Slice merge failed — stopping auto-mode. Fix conflicts manually and restart.\n${message}`,
               "error",
             );
-            // Re-derive state so dispatch can figure out what to do
-            state = await deriveState(basePath);
-            mid = state.activeMilestone?.id;
-            midTitle = state.activeMilestone?.title;
+            if (currentUnit) {
+              const modelId = ctx.model?.id ?? "unknown";
+              snapshotUnitMetrics(ctx, currentUnit.type, currentUnit.id, currentUnit.startedAt, modelId);
+              saveActivityLog(ctx, basePath, currentUnit.type, currentUnit.id);
+            }
+            await stopAuto(ctx, pi);
+            return;
           }
         }
       }
@@ -1157,9 +1179,19 @@ async function dispatchNextUnit(
       const hasResearch = !!(researchFile && await loadFile(researchFile));
 
       if (!hasResearch) {
-        unitType = "research-slice";
-        unitId = `${mid}/${sid}`;
-        prompt = await buildResearchSlicePrompt(mid, midTitle!, sid, sTitle, basePath);
+        // Skip slice research for S01 when milestone research already exists —
+        // the milestone research already covers the same ground for the first slice.
+        const milestoneResearchFile = resolveMilestoneFile(basePath, mid, "RESEARCH");
+        const hasMilestoneResearch = !!(milestoneResearchFile && await loadFile(milestoneResearchFile));
+        if (hasMilestoneResearch && sid === "S01") {
+          unitType = "plan-slice";
+          unitId = `${mid}/${sid}`;
+          prompt = await buildPlanSlicePrompt(mid, midTitle!, sid, sTitle, basePath);
+        } else {
+          unitType = "research-slice";
+          unitId = `${mid}/${sid}`;
+          prompt = await buildResearchSlicePrompt(mid, midTitle!, sid, sTitle, basePath);
+        }
       } else {
         unitType = "plan-slice";
         unitId = `${mid}/${sid}`;
@@ -1623,6 +1655,7 @@ async function buildPlanMilestonePrompt(mid: string, midTitle: string, base: str
 
   const outputRelPath = relMilestoneFile(base, mid, "ROADMAP");
   const outputAbsPath = resolveMilestoneFile(base, mid, "ROADMAP") ?? join(base, outputRelPath);
+  const secretsOutputPath = relMilestoneFile(base, mid, "SECRETS");
   return loadPrompt("plan-milestone", {
     milestoneId: mid, milestoneTitle: midTitle,
     milestonePath: relMilestonePath(base, mid),
@@ -1630,6 +1663,7 @@ async function buildPlanMilestonePrompt(mid: string, midTitle: string, base: str
     researchPath: researchRel,
     outputPath: outputRelPath,
     outputAbsPath,
+    secretsOutputPath,
     inlinedContext,
   });
 }

package/src/resources/extensions/gsd/docs/preferences-reference.md

@@ -47,6 +47,7 @@ Full documentation for `~/.gsd/preferences.md` (global) and `.gsd/preferences.md
   - `snapshots`: boolean — create snapshot commits (WIP saves) during long-running tasks. Default: `false`.
   - `pre_merge_check`: boolean or `"auto"` — run pre-merge checks before merging a slice branch. `true` always runs, `false` never runs, `"auto"` runs when CI is detected. Default: `false`.
   - `commit_type`: string — override the conventional commit type prefix. Must be one of: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`, `perf`, `ci`, `build`, `style`. Default: inferred from diff content.
+  - `main_branch`: string — the primary branch name for new git repos (e.g., `"main"`, `"master"`, `"trunk"`). Also used by `getMainBranch()` as the preferred branch when auto-detection is ambiguous. Default: `"main"`.
 
 ---
 

package/src/resources/extensions/gsd/files.ts

@@ -13,6 +13,7 @@ import type {
   Summary, SummaryFrontmatter, SummaryRequires, FileModified,
   Continue, ContinueFrontmatter, ContinueStatus,
   RequirementCounts,
+  SecretsManifest, SecretsManifestEntry, SecretsManifestEntryStatus,
 } from './types.ts';
 
 // ─── Helpers ───────────────────────────────────────────────────────────────
@@ -263,6 +264,75 @@ export function parseRoadmap(content: string): Roadmap {
   return { title, vision, successCriteria, slices, boundaryMap };
 }
 
+// ─── Secrets Manifest Parser ───────────────────────────────────────────────
+
+const VALID_STATUSES = new Set<SecretsManifestEntryStatus>(['pending', 'collected', 'skipped']);
+
+export function parseSecretsManifest(content: string): SecretsManifest {
+  const milestone = extractBoldField(content, 'Milestone') || '';
+  const generatedAt = extractBoldField(content, 'Generated') || '';
+
+  const h3Sections = extractAllSections(content, 3);
+  const entries: SecretsManifestEntry[] = [];
+
+  for (const [heading, sectionContent] of h3Sections) {
+    const key = heading.trim();
+    if (!key) continue;
+
+    const service = extractBoldField(sectionContent, 'Service') || '';
+    const dashboardUrl = extractBoldField(sectionContent, 'Dashboard') || '';
+    const formatHint = extractBoldField(sectionContent, 'Format hint') || '';
+    const rawStatus = (extractBoldField(sectionContent, 'Status') || 'pending').toLowerCase().trim() as SecretsManifestEntryStatus;
+    const status: SecretsManifestEntryStatus = VALID_STATUSES.has(rawStatus) ? rawStatus : 'pending';
+    const destination = extractBoldField(sectionContent, 'Destination') || 'dotenv';
+
+    // Extract numbered guidance list (lines matching "1. ...", "2. ...", etc.)
+    const guidance: string[] = [];
+    for (const line of sectionContent.split('\n')) {
+      const numMatch = line.match(/^\s*\d+\.\s+(.+)/);
+      if (numMatch) {
+        guidance.push(numMatch[1].trim());
+      }
+    }
+
+    entries.push({ key, service, dashboardUrl, guidance, formatHint, status, destination });
+  }
+
+  return { milestone, generatedAt, entries };
+}
+
+// ─── Secrets Manifest Formatter ───────────────────────────────────────────
+
+export function formatSecretsManifest(manifest: SecretsManifest): string {
+  const lines: string[] = [];
+
+  lines.push('# Secrets Manifest');
+  lines.push('');
+  lines.push(`**Milestone:** ${manifest.milestone}`);
+  lines.push(`**Generated:** ${manifest.generatedAt}`);
+
+  for (const entry of manifest.entries) {
+    lines.push('');
+    lines.push(`### ${entry.key}`);
+    lines.push('');
+    lines.push(`**Service:** ${entry.service}`);
+    if (entry.dashboardUrl) {
+      lines.push(`**Dashboard:** ${entry.dashboardUrl}`);
+    }
+    if (entry.formatHint) {
+      lines.push(`**Format hint:** ${entry.formatHint}`);
+    }
+    lines.push(`**Status:** ${entry.status}`);
+    lines.push(`**Destination:** ${entry.destination}`);
+    lines.push('');
+    for (let i = 0; i < entry.guidance.length; i++) {
+      lines.push(`${i + 1}. ${entry.guidance[i]}`);
+    }
+  }
+
+  return lines.join('\n') + '\n';
+}
+
 // ─── Slice Plan Parser ─────────────────────────────────────────────────────
 
 export function parsePlan(content: string): SlicePlan {

package/src/resources/extensions/gsd/git-service.ts

@@ -9,8 +9,7 @@
  */
 
 import { execSync } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { join, sep } from "node:path";
+import { sep } from "node:path";
 
 import {
   detectWorktreeName,
@@ -249,9 +248,6 @@ export class GitServiceImpl {
    * branch (preserves planning artifacts). Falls back to main when on another
    * slice branch (avoids chaining slice branches).
    *
-   * When creating a new branch, fetches from remote first (best-effort) to
-   * ensure the local main is up-to-date.
-   *
    * Auto-commits dirty state via smart staging before checkout so runtime
    * files are never accidentally committed during branch switches.
    *
@@ -272,9 +268,8 @@ export class GitServiceImpl {
       if (remotes) {
         const remote = this.prefs.remote ?? "origin";
         const fetchResult = this.git(["fetch", "--prune", remote], { allowFailure: true });
-        // fetchResult is empty string on both success and allowFailure-caught error.
-        // Check if local is behind upstream (informational only).
-        if (remotes.split("\n").includes(remote)) {
+        if (fetchResult === "" && remotes.split("\n").includes(remote)) {
+          // Check if local is behind upstream (informational only)
           const behind = this.git(
             ["rev-list", "--count", "HEAD..@{upstream}"],
             { allowFailure: true },
@@ -348,93 +343,12 @@ export class GitServiceImpl {
   /**
    * Run pre-merge verification check. Auto-detects test runner from project
    * files, or uses custom command from prefs.pre_merge_check.
-   *
-   * Gating:
-   * - `false` → skip (return passed:true, skipped:true)
-   * - non-empty string (not "auto") → use as custom command
-   * - `true`, `"auto"`, or `undefined` → auto-detect from project files
-   *
-   * Auto-detection order:
-   *   package.json scripts.test → npm test
-   *   package.json scripts.build (only if no test) → npm run build
-   *   Cargo.toml → cargo test
-   *   Makefile with test: target → make test
-   *   pyproject.toml → python -m pytest
-   *
-   * If no runner detected in auto mode, returns passed:true (don't block).
+   * Gated on prefs.pre_merge_check (false = skip, string = custom command).
+   * Stub: to be implemented in T03.
    */
   runPreMergeCheck(): PreMergeCheckResult {
-    const pref = this.prefs.pre_merge_check;
-
-    // Explicitly disabled
-    if (pref === false) {
-      return { passed: true, skipped: true };
-    }
-
-    let command: string | null = null;
-
-    // Custom string command (not "auto")
-    if (typeof pref === "string" && pref !== "auto" && pref.trim() !== "") {
-      command = pref.trim();
-    }
-
-    // Auto-detect (true, "auto", or undefined)
-    if (command === null) {
-      command = this.detectTestRunner();
-    }
-
-    if (command === null) {
-      return { passed: true, command: "none", error: "no test runner detected" };
-    }
-
-    // Execute the command
-    try {
-      execSync(command, {
-        cwd: this.basePath,
-        timeout: 300_000,
-        stdio: ["ignore", "pipe", "pipe"],
-        encoding: "utf-8",
-      });
-      return { passed: true, command };
-    } catch (err) {
-      const stderr = err instanceof Error && "stderr" in err
-        ? String((err as { stderr: unknown }).stderr).slice(0, 2000)
-        : String(err).slice(0, 2000);
-      return { passed: false, command, error: stderr };
-    }
-  }
-
-  /**
-   * Detect a test/build runner from project files in basePath.
-   * Returns the command string or null if nothing detected.
-   */
-  private detectTestRunner(): string | null {
-    const pkgPath = join(this.basePath, "package.json");
-    if (existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
-        if (pkg?.scripts?.test) return "npm test";
-        if (pkg?.scripts?.build) return "npm run build";
-      } catch { /* invalid JSON — skip */ }
-    }
-
-    if (existsSync(join(this.basePath, "Cargo.toml"))) {
-      return "cargo test";
-    }
-
-    const makefilePath = join(this.basePath, "Makefile");
-    if (existsSync(makefilePath)) {
-      try {
-        const content = readFileSync(makefilePath, "utf-8");
-        if (/^test\s*:/m.test(content)) return "make test";
-      } catch { /* skip */ }
-    }
-
-    if (existsSync(join(this.basePath, "pyproject.toml"))) {
-      return "python -m pytest";
-    }
-
-    return null;
+    // TODO(S05/T03): implement pre-merge check
+    return { passed: true, skipped: true };
   }
 
   // ─── Merge ─────────────────────────────────────────────────────────────
@@ -522,7 +436,8 @@ export class GitServiceImpl {
       );
     }
 
-    // Snapshot the branch HEAD before merge (gated on prefs.snapshots)
+    // Snapshot the branch HEAD before merge (gated on prefs)
+    // We need to save the ref while the branch still exists
     this.createSnapshot(branch);
 
     // Build rich commit message before squash (needs branch history)
@@ -531,18 +446,20 @@ export class GitServiceImpl {
       commitType, milestoneId, sliceId, sliceTitle, mainBranch, branch,
     );
 
-    // Squash merge
-    this.git(["merge", "--squash", branch]);
-
-    // Pre-merge check: run after squash (tests merged result), reset on failure
-    const checkResult = this.runPreMergeCheck();
-    if (!checkResult.passed && !checkResult.skipped) {
-      // Undo the squash merge — nothing committed yet, reset staging area
-      this.git(["reset", "--hard", "HEAD"]);
-      const cmdInfo = checkResult.command ? ` (command: ${checkResult.command})` : "";
-      const errInfo = checkResult.error ? `\n${checkResult.error}` : "";
+    // Squash merge — abort cleanly on conflict so the working tree is never
+    // left in a half-merged state (see: merge-bug-fix).
+    try {
+      this.git(["merge", "--squash", branch]);
+    } catch (mergeError) {
+      // git merge --squash exits non-zero on conflict. The working tree now
+      // has conflict markers and a dirty index. Reset to restore a clean state.
+      this.git(["reset", "--hard", "HEAD"], { allowFailure: true });
+      const msg = mergeError instanceof Error ? mergeError.message : String(mergeError);
       throw new Error(
-        `Pre-merge check failed${cmdInfo}. Merge aborted.${errInfo}`,
+        `Squash-merge of "${branch}" into "${mainBranch}" failed with conflicts. ` +
+        `Working tree has been reset to a clean state. ` +
+        `Resolve manually: git checkout ${mainBranch} && git merge --squash ${branch}\n` +
+        `Original error: ${msg}`,
       );
     }
 
@@ -555,7 +472,11 @@ export class GitServiceImpl {
     // Auto-push to remote if enabled
     if (this.prefs.auto_push === true) {
       const remote = this.prefs.remote ?? "origin";
-      this.git(["push", remote, mainBranch], { allowFailure: true });
+      const pushResult = this.git(["push", remote, mainBranch], { allowFailure: true });
+      if (pushResult === "") {
+        // push succeeded (empty stdout is normal) or failed silently
+        // Verify by checking if remote is reachable — the allowFailure handles errors
+      }
     }
 
     return {

package/src/resources/extensions/gsd/gitignore.ts

@@ -145,6 +145,7 @@ See \`~/.gsd/agent/extensions/gsd/docs/preferences-reference.md\` for full field
 - \`models\`: Model preferences for specific task types
 - \`skill_discovery\`: Automatic skill detection preferences
 - \`auto_supervisor\`: Supervision and gating rules for autonomous modes
+- \`git\`: Git preferences — \`main_branch\` (default branch name for new repos, e.g., "main", "master", "trunk"), \`auto_push\`, \`snapshots\`, etc.
 
 ## Examples
 

package/src/resources/extensions/gsd/guided-flow.ts

@@ -20,8 +20,9 @@ import {
 } from "./paths.js";
 import { join } from "node:path";
 import { readFileSync, existsSync, mkdirSync, readdirSync } from "node:fs";
-import { execSync } from "node:child_process";
+import { execSync, execFileSync } from "node:child_process";
 import { ensureGitignore, ensurePreferences } from "./gitignore.js";
+import { loadEffectiveGSDPreferences } from "./preferences.js";
 
 // ─── Auto-start after discuss ─────────────────────────────────────────────────
 
@@ -444,7 +445,8 @@ export async function showSmartEntry(
   try {
     execSync("git rev-parse --git-dir", { cwd: basePath, stdio: "pipe" });
   } catch {
-    execSync("git init", { cwd: basePath, stdio: "pipe" });
+    const mainBranch = loadEffectiveGSDPreferences()?.preferences?.git?.main_branch || "main";
+    execFileSync("git", ["init", "-b", mainBranch], { cwd: basePath, stdio: "pipe" });
   }
 
   // ── Ensure .gitignore has baseline patterns ──────────────────────────
@@ -609,8 +611,9 @@ export async function showSmartEntry(
       });
 
       if (choice === "plan") {
+        const secretsOutputPath = relMilestoneFile(basePath, milestoneId, "SECRETS");
         dispatchWorkflow(pi, loadPrompt("guided-plan-milestone", {
-          milestoneId, milestoneTitle,
+          milestoneId, milestoneTitle, secretsOutputPath,
         }));
       } else if (choice === "discuss") {
         dispatchWorkflow(pi, loadPrompt("guided-discuss-milestone", {